Cases › operational mistake › LR-2026-0606
AI agent bogus scan leaves developer begging for crypto donations
Preliminary Why: 1 report: Decrypt · subject to change · 1 independent report
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
An AI agent called JertLinc3522 was given AWS credentials, a deadline and a goal of mapping the DN42 volunteer network, a decentralized hobbyist network. It autonomously provisioned five high-powered AWS instances to port-scan the network and filed a pull request describing the scan. The network's community noticed the scan immediately and responded by feeding the agent deliberately bad tasks. The bill reached $6,531.30 in under 24 hours before the operator noticed and stopped the agent. AWS later negotiated the bill down to $1,894, after the agent repeatedly deployed the same CloudFormation template and created duplicate instances. The operator then asked the community for Ethereum donations to cover the cost. Nobody sent any donations.
What happened
What was done
No source states an action or fix.
Risks
Primary63 incidents
Rising: 5 vs 2.2 a week
Read from the sources; not yet reviewed by a person.
Controls
HarnessEffective Stop control
ApplicationDid not exist Human approval for high-impact actions
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
Other controls for this risk at this layer, not mentioned in the sources: Tool allow-list, Fail-closed defaults.
L3 · ApplicationDeployer not namedDeployer
Other controls for this risk at this layer, not mentioned in the sources: Change review and separation of duties, Least-privilege access for the agent, Production kept apart from test, Activity logs, Adversarial testing before deployment.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Backups and recovery.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Stop control | L2 Harness | Effective |
| Tool allow-list | L2 Harness | Not stated in sources |
| Fail-closed defaults | L2 Harness | Not stated in sources |
| Human approval for high-impact actions | L3 Application | Did not exist |
| Least-privilege access for the agent | L3 Application | Not stated in sources |
| Production kept apart from test | L3 Application | Not stated in sources |
| Change review and separation of duties | L3 Application | Not stated in sources |
| Activity logs | L3 Application | Not stated in sources |
| Adversarial testing before deployment | L3 Application | Not stated in sources |
| Backups and recovery | L4 Infrastructure / target | Not stated in sources |
Evidence
No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 3 items from the primary sources
What happened, in order
- May 9 The agent asked the DN42 network to register it as a member.
Not dated in the sources:
- The bill accrued within under 24 hours before the operator noticed.
- The operator stopped the agent.
Show every field, with its source and grade
What happened
Impact
Notes on gaps
Control outcomes for A1 and B1 are inferred from the stated lack of scoped credentials and human approval; B3 held per the operator's stop. The remediation advice is from the press writer, not the implicated party.
LR-2026-0606 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON